New issue
Advanced search Search tips

Issue 853424 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 6
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug-Security



Sign in to add a comment

Stack-use-after-return in TDiagnostics::writeDebug

Project Member Reported by ClusterFuzz, Jun 16 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5468244153204736

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Stack-use-after-return READ 8
Crash Address: 0x7f880cb77960
Crash State:
  TDiagnostics::writeDebug
  TParseContext::trace
  Trace
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=549950:549963

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5468244153204736

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jun 16 2018

Components: Internals>GPU>SwiftShader
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jun 16 2018

Cc: piman@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jun 16 2018

Labels: Test-Predator-Auto-Owner
Owner: enne@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/92f16ea7c0a121caf3f73a75c87f407b545647dc (Generate gpu workaround list from text files).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 16 2018

Labels: Target-67 M-67
Project Member

Comment 5 by sheriffbot@chromium.org, Jun 16 2018

Labels: Pri-1

Comment 6 by piman@chromium.org, Jun 18 2018

Cc: sugoi@chromium.org enne@chromium.org
Owner: capn@chromium.org
Not enne's change per se. It changed the order of workarounds in the list, which means the interpretation of the "config" bits for the fuzzer changes over that CL, however the issue predates it.

Comment 7 by capn@chromium.org, Jun 19 2018

Labels: -Pri-1 -Security_Severity-High -M-67 -Target-67 M-69 Security_Severity-Low Target-69 Pri-2
Status: Started (was: Assigned)
This code is only in Debug builds, so it's low severity.
Project Member

Comment 8 by bugdroid1@chromium.org, Jun 26 2018

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/659d89e94bf94240805b1d075017e43e8b388095

commit 659d89e94bf94240805b1d075017e43e8b388095
Author: Nicolas Capens <capn@google.com>
Date: Tue Jun 26 19:29:19 2018

Support glCopyTexImage2D for float formats.

 Bug chromium:853424 

Change-Id: I9b2de054baf6b042bcd04c5d023099a39ca20d2a
Reviewed-on: https://swiftshader-review.googlesource.com/19569
Tested-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>

[modify] https://crrev.com/659d89e94bf94240805b1d075017e43e8b388095/src/OpenGL/libGLESv2/libGLESv2.cpp
[modify] https://crrev.com/659d89e94bf94240805b1d075017e43e8b388095/tests/unittests/unittests.cpp

Project Member

Comment 9 by bugdroid1@chromium.org, Jul 5

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/e1fa9ea70faa6931505bce64f5d97539c88712e9

commit e1fa9ea70faa6931505bce64f5d97539c88712e9
Author: Nicolas Capens <capn@google.com>
Date: Thu Jul 05 17:13:23 2018

Reject copying from GL_RGB10_A2 to unsized formats.

glCopyTexImage2D() with an framebuffer format of GL_RGB10_A2 and
internalformat of GL_LUMINANCE_ALPHA was hitting the UNIMPLEMENTED()
assert.

The spec states that:
If an effective internal format exists that has
   * the same component sizes as,
   * component sizes greater than or equal to, or
   * component sizes smaller than or equal to
 those of the source buffer's effective internal format (for all
 matching components in <internalformat>), that format is chosen for
 the new image array and this is the effective internal format of the
 new texel array.

There is no unorm luminance+alpha format that has all components either
greater or smaller, so this operation is invalid.

Also see https://www.khronos.org/members/login/bugzilla/show_bug.cgi?id=9807#c56

 Bug chromium:853424 

Change-Id: Ia79a50bf7411a3f2aa87cf7f9bdbcbf971bdd7ce
Reviewed-on: https://swiftshader-review.googlesource.com/19768
Tested-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>

[modify] https://crrev.com/e1fa9ea70faa6931505bce64f5d97539c88712e9/src/OpenGL/libGLESv2/libGLESv2.cpp

Project Member

Comment 10 by ClusterFuzz, Jul 6

ClusterFuzz has detected this issue as fixed in range 572608:573021.

Detailed report: https://clusterfuzz.com/testcase?key=5468244153204736

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Stack-use-after-return READ 8
Crash Address: 0x7f880cb77960
Crash State:
  TDiagnostics::writeDebug
  TParseContext::trace
  Trace
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=549950:549963
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=572608:573021

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5468244153204736

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Jul 6

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 5468244153204736 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by sheriffbot@chromium.org, Jul 7

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: Release-0-M69
Project Member

Comment 14 by sheriffbot@chromium.org, Oct 13

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment